--- title: Lost Company Laptop? A 24-Hour Checklist for What to Do Next description: Whether a lost laptop becomes a data breach depends on encryption. Here is what to do in the first hour, the first day, and the week after. image: https://images.unsplash.com/photo-1768793096346-6d84e93e4195?auto=format&fit=crop&w=1080&q=80 --- [Skip to content](https://www.phalanxmanagement.com/phalanx-llc-blog/lost-company-laptop-checklist#main-content) ![](https://www.phalanxmanagement.com/hs-fs/hubfs/Circle%20Logo%20White.png?width=5732&height=5732&name=Circle%20Logo%20White.png)Homepage - Home - Products - Pricing - Blog - Company Get started - Home - Products - Pricing - Blog - Company Get started ![lost company laptop checklist](https://images.unsplash.com/photo-1768793096346-6d84e93e4195?auto=format&fit=crop&w=1080&q=80) # Lost Company Laptop? A 24-Hour Checklist for What to Do Next ![Josh Caliguire](https://www.phalanxmanagement.com/hs-fs/hubfs/Closeup%202x%202025%20bio.jpg?width=48&height=48&name=Closeup%202x%202025%20bio.jpg) Josh Caliguire October 14, 2026 ## The short answer Lock the laptop through your device management tool within the first hour, then sign the employee out of every account. If the drive was encrypted and the password wasn't with it, the data is very likely safe. Encryption is the deciding factor. Under [HHS breach notification guidance](https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html), properly encrypted health data does not count as "unsecured," so losing it does not trigger HIPAA breach notification. Many state breach laws treat encrypted data the same way. If the laptop was unencrypted or unmanaged, the next 24 hours are about finding out what was on it and whether you have to tell anyone. **Could you lock a laptop right now?** Answer 10 questions in about 2 minutes. No login. See whether your devices are encrypted and remotely manageable. [Take the free MDM Health Check](https://www.phalanxmanagement.com/mdm-health-check) ![Person sitting by a window at an airport gate](https://images.unsplash.com/photo-1675299363766-123ac94461c7?auto=format&fit=crop&w=1080&q=80) ## Where you stand depends on two questions Was the drive encrypted, and is the laptop enrolled in MDM? The answers set your next 24 hours. | Situation | Risk to the data | What you can do remotely | Next step | | --- | --- | --- | --- | | Encrypted and managed | Low, if the password wasn't stored with it | Lock and wipe | Lock now, wipe if it isn't recovered | | Encrypted, not managed | Low for the data | Nothing on the device itself | Revoke accounts and sessions, then document it | | Not encrypted, managed | High until the wipe lands | Lock and wipe when it connects | Wipe now, then list what was on it | | Not encrypted, not managed | High | Nothing | List the data and get legal advice on notification | FileVault on Mac and BitLocker on Windows are built in. The usual gap is turning them on for every laptop and being able to prove it. ## The first hour 1. **Get the facts.** Which device, when and where it was last seen, and whether it was asleep or shut down. A laptop that was asleep is more exposed, because its disk is already unlocked. 2. **Send a lock command.** An MDM can lock a Mac with a six-digit PIN and a message, and the Mac won't start macOS until someone enters it ([Apple](https://support.apple.com/guide/deployment/depb980a0be4/web)). Intune can [remotely lock](https://learn.microsoft.com/en-us/intune/intune-service/remote-actions/device-remote-lock) Windows devices too. 3. **Cut off the accounts.** Sign the user out of email, chat, and cloud apps from the admin console. Then reset their password and check their MFA devices. 4. **Report a theft.** If it was stolen, file a police report. Your insurer will likely ask for the report number. ## The first 24 hours - **Decide on the wipe.** A lock keeps the laptop recoverable. A wipe erases it. [Apple](https://support.apple.com/guide/security/secc46f3562c/web) notes that a remote wipe makes all data unreadable, and the device confirms to the MDM before it erases. If recovery looks unlikely, wipe it. - **Confirm encryption status.** Pull the device record from your MDM. A report showing FileVault or BitLocker was on at the time of loss is your strongest evidence. - **List what was on it.** Customer files, health data, financial records, saved passwords. That list decides whether notification laws apply. - **Check notification rules.** Every state has a breach notification law, and [NCSL tracks them](https://www.ncsl.org/technology-and-communication/security-breach-notification-laws). If unencrypted personal data was exposed, get legal advice before deadlines start running. The FTC's [Data Breach Response guide](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) walks through the steps. **Can you prove your laptops are encrypted?** The Health Check covers encryption, patching, and device visibility. If you're not sure, that is the finding. [Take the free MDM Health Check](https://www.phalanxmanagement.com/mdm-health-check) ![Closed laptop resting on a table](https://images.unsplash.com/photo-1675868374826-c439570927ff?auto=format&fit=crop&w=1080&q=80) ## The week after - **Write it up.** Keep a short record with times, actions, and who took them. Auditors and insurers will ask for it. - **Replace the laptop from a standard setup.** If laptops enroll in MDM automatically, the new one arrives encrypted and ready to work. - **Fix whatever made it scary.** If you couldn't lock it or couldn't prove it was encrypted, that is the project for this quarter. ![Team meeting around a table with laptops](https://images.unsplash.com/photo-1542744173-8e7e53415bb0?auto=format&fit=crop&w=1080&q=80) ## When you can skip the scramble If every laptop is encrypted, enrolled in MDM, and reporting its status, a lost laptop is mostly a replacement order and a short write-up. The data is unreadable, and the wipe lands the next time it connects. If your team is five people on their own Macs, full MDM might be more than you need today. At minimum, turn on FileVault or BitLocker, require a strong login password, and keep a list of who has which device. That covers the biggest risk at almost no cost. The scramble happens when nobody knows whether the drive was encrypted. Answer that question before the next laptop goes missing. If you are weighing who should own it, our post on [in-house IT vs. managed MDM](https://www.phalanxmanagement.com/phalanx-llc-blog/in-house-it-hire-vs-managed-mdm) runs the numbers. ## FAQ ### What should I do first if an employee loses a company laptop? Lock it through your MDM and sign the employee out of every account. Both can happen in the first hour, before you know whether the laptop will turn up. ### Is a lost encrypted laptop a data breach? Usually not, as long as the password or recovery key was not lost with it. HIPAA and many state laws treat properly encrypted data as protected. Check with counsel if sensitive data was involved. ### Can you wipe a laptop that is turned off? The command waits. The laptop receives the lock or wipe the next time it connects to the internet, which is why encryption matters in the meantime. ### Should I lock or wipe a lost laptop? Lock first, since a lock can be undone if the laptop turns up. Wipe once recovery looks unlikely, or right away if the drive was not encrypted. ## Be ready before the next one goes missing **Find the gaps first** Take the free 10-question MDM Health Check and see which laptops you could lock today. [Take the free MDM Health Check](https://www.phalanxmanagement.com/mdm-health-check) Prefer to talk it through? Book a free consult. We will check which of your devices are encrypted and enrolled, walk through what you could do remotely today, and give you a plain read on what to fix first. [Book a free consult](https://www.phalanxmanagement.com/schedule) ## Share this post [mailto:https%3A%2F%2Fwww.phalanxmanagement.com%2Fphalanx-llc-blog%2Flost-company-laptop-checklist](mailto:https%3A%2F%2Fwww.phalanxmanagement.com%2Fphalanx-llc-blog%2Flost-company-laptop-checklist) ## Keep reading ### [![employee offboarding checklist](https://images.unsplash.com/photo-1758691738691-557c09410bf7?auto=format&fit=crop&w=1080&q=80) Employee Offboarding Checklist: Securing Devices and Accounts on Day One](https://www.phalanxmanagement.com/phalanx-llc-blog/employee-offboarding-checklist-devices-accounts) ### [![Team working on laptops kept SOC 2 audit-ready by device management](https://www.phalanxmanagement.com/hubfs/photo-1522071820081-009f0129c71c.avif) SOC2 MDM Device Compliance How to Prepare Your Devices for a SOC 2 Audit](https://www.phalanxmanagement.com/phalanx-llc-blog/prepare-devices-soc-2-audit) [![](https://www.phalanxmanagement.com/hs-fs/hubfs/Circle%20Logo%20White.png?width=5732&height=5732&name=Circle%20Logo%20White.png)](https://www.phalanxmanagement.com/) - Home - Products - Pricing - Blog - Company --- Privacy Policy · Legal · © 2026. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Josh Caliguire", "url" : "https://www.phalanxmanagement.com/phalanx-llc-blog/author/josh-caliguire" }, "dateModified" : "2026-10-14T01:17:23.460Z", "datePublished" : "2026-10-14T01:17:23.000Z", "headline" : "Lost Company Laptop? A 24-Hour Checklist for What to Do Next", "image" : [ "https://images.unsplash.com/photo-1768793096346-6d84e93e4195?auto=format&fit=crop&w=1080&q=80" ], "mainEntityOfPage" : { "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/lost-company-laptop-checklist", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.phalanxmanagement.com/hubfs/Circle%20Logo%20White.png" } } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/lost-company-laptop-checklist#post", "@type" : "BlogPosting", "articleSection" : "IT Management", "author" : { "@type" : "Person", "name" : "Josh Caliguire" }, "dateModified" : "2026-10-13", "datePublished" : "2026-10-13", "description" : "Whether a lost laptop becomes a data breach depends on encryption. Here is what to do in the first hour, the first day, and the week after.", "headline" : "Lost Company Laptop? A 24-Hour Checklist for What to Do Next", "image" : "https://images.unsplash.com/photo-1768793096346-6d84e93e4195?auto=format&fit=crop&w=1080&q=80", "keywords" : "lost company laptop, stolen laptop checklist, remote wipe laptop, MDM lock, encrypted laptop breach, laptop data breach", "mainEntityOfPage" : { "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/lost-company-laptop-checklist", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "name" : "Phalanx Management", "url" : "https://www.phalanxmanagement.com" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/lost-company-laptop-checklist#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Lock it through your MDM and sign the employee out of every account. Both can happen in the first hour, before you know whether the laptop will turn up." }, "name" : "What should I do first if an employee loses a company laptop?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Usually not, as long as the password or recovery key was not lost with it. HIPAA and many state laws treat properly encrypted data as protected. Check with counsel if sensitive data was involved." }, "name" : "Is a lost encrypted laptop a data breach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The command waits. The laptop receives the lock or wipe the next time it connects to the internet, which is why encryption matters in the meantime." }, "name" : "Can you wipe a laptop that is turned off?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Lock first, since a lock can be undone if the laptop turns up. Wipe once recovery looks unlikely, or right away if the drive was not encrypted." }, "name" : "Should I lock or wipe a lost laptop?" } ] } ```